Brexit: the EU data protection package

The Committee's report on 'Brexit: the EU data protection package' examines the overhaul of the European Union's data protection standards enacted in 2016, and the implications for data transfers between the UK and the EU post-Brexit. The ability to move data across borders has become central to trade. About half of all trade in services is enabled by digital technologies and associated data flows. The importance of cross-border data flows to the UK cannot be overstated. Trade in services now accounts for 44% of the UK's total global exports, and three quarters of the UK’s cross-border data flows are with EU Member States.


The report considers four elements of the EU data protection package: the General Data Protection Regulation (GDPR), the Police and Criminal Justice Directive (PCJ Directive), the EU-US Privacy Shield, and the EU-US Umbrella Agreement. The GDPR and PCJ Directive will enter into force in May 2018, while the UK is still a member of the EU. When the UK leaves the EU, it will no longer be bound by the EU's data protection laws, including the GDPR and the PCJ Directive, and will no longer be party to the EU-US Privacy Shield or the EU-US Umbrella Agreement. 

Key findings

  • The Government has stated clearly that it wants to maintain unhindered data flows. The Committee supports this objective, but was struck by the lack of detail on how the Government plans to deliver this.
  • Any post-Brexit arrangement that leads to greater friction around UK-EU data flows could pose a non-tariff barrier to trade, putting the UK at a competitive disadvantage.
  • Any impediments to data sharing could hinder police and security cooperation. For example, access to databases such as the Schengen Information System (SIS II) and the European Criminal Records Information System (ECRIS) rely on shared data protection standards.
  • The report recommends that the Government pursue an 'adequacy decision' as the most comprehensive option for maintaining unhindered data flows post-Brexit. Alternatives, such as reliance on Standard Contractual Clauses would be less effective.
  • Adequacy decisions are only made with regard to third countries–in this context, non-EU Member States–and follow a set procedure. To avoid a cliff-edge there will need to transitional arrangements to cover the gap between leaving the EU and obtaining an adequacy decision.
  • The UK could find itself being held to a higher standard as a third country than it does as a Member State, since it will no longer be able to rely on the national security exemption on the Treaty on the Functioning of the European Union.
  • Even though the UK will no longer be bound by EU data protection laws, there is no prospect of a clean break. Legal controls on the transfer of personal data to non-EU countries mean that any changes in the EU data protection regime could affect the standards that the UK needs to meet to maintain an adequate level of protection.
  • Brexit means the UK will lose the institutional platform from which it has been able to influence EU data protection rules. We recommend that the Government secure a continuing role for the UK's Information Commissioner’s Office on the European Data Protection Board.

This report arises out of routine scrutiny of EU legislative proposals, but also forms part of the coordinated series of Brexit-themed inquiries launched by the European Committee and its six Sub-Committees following the referendum on 23 June 2016.



  • Close


    • Reports and associated evidence - reports and evidence featuring written submissions and corrected oral evidence published at the conclusion of Committee inquiries. Evidence is periodically updated over the course of an inquiry and is not finalised until the relevant Report is published.
    • Uncorrected oral evidence - transcripts of oral evidence not yet approved by the Committee or witnesses.
    • Other oral evidence - corrected transcripts of oral evidence, usually taken for scrutiny purposes or for ad hoc/regular evidence sessions with Ministers.
    • Evidence - written submissions and corrected oral evidence published for scrutiny purposes or for ad hoc/regular evidence sessions with Ministers.
    • Responses to Reports - Government Department and European Commission responses to reports.
    • Call for Evidence - request to submit evidence to a Committee inquiry.
    • Correspondence - correspondence received and sent by the Committee excluding ministerial correspondence.
    • Correspondence with Ministers - Ministerial correspondence received and sent by the Committee.
    • Progress of Scrutiny - records the decisions taken by the EU Committee on European documents that have been deposited in Parliament for scrutiny.